An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution. This vulnerability is associated with the file libavcodec/magicyuv.C. This issue affects FFmpeg before version 8.1.2.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ba8d239f-709f-11f1-a30e-28d2443e6cfa advisory.

    https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159 reports:
    An out-of-bounds write vulnerability in FFmpeg's libavcodec library,     specifically in the MagicYUV decoder, allows denial-of-service and,     in some cases, can be exploited for remote code execution. This     vulnerability is associated with the file libavcodec/magicyuv.C.
    This issue affects FFmpeg before version 8.1.2.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6361 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6361-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     June 22, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : ffmpeg     CVE ID         : CVE-2025-22921 CVE-2026-8461 CVE-2026-30997

    Several vulnerabilities have been discovered in the FFmpeg multimedia     framework, which could result in denial of service or potentially the     execution of arbitrary code if malformed files/streams are processed.

    For the stable distribution (trixie), these problems have been fixed in     version 7:7.1.5-0+deb13u1.

    We recommend that you upgrade your ffmpeg packages.

    For the detailed security status of ffmpeg please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/ffmpeg

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FFmpeg installed on the remote host is prior to 8.1.2. It is, therefore, affected by an out-of-bounds write vulnerability:

  - An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows     denial-of-service and, in some cases, can be exploited for remote code execution. (CVE-2026-8461)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder,     allows denial-of-service and, in some cases, can be exploited for remote code execution. This     vulnerability is associated with the file libavcodec/magicyuv.C. This issue affects FFmpeg before version     8.1.2. (CVE-2026-8461)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
323600	FreeBSD : ffmpeg -- Out-of-bounds write (ba8d239f-709f-11f1-a30e-28d2443e6cfa)	Nessus	FreeBSD Local Security Checks	high
321987	Debian dsa-6361 : ffmpeg - security update	Nessus	Debian Local Security Checks	high
321914	FFmpeg < 8.1.2 Out-of-Bounds Write (CVE-2026-8461)	Nessus	Misc.	high
321684	Linux Distros Unpatched Vulnerability : CVE-2026-8461	Nessus	Misc.	high

Detections

Analytics

CVE-2026-8461

high

Tenable Plugins

high

high

high

high